Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
4,714 Commits 16 Branches 39 Tags
cdf5cf7b9743234b3d67a44ffa0e8d0eac713b40
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk Wetter cdf5cf7b97 remove + @ beginning of line 2025-01-27 17:20:39 +01:00
Dirk Wetter ef13122f4f fix typo 2025-01-27 16:39:02 +01:00
Dirk Wetter b984ae5ea2 minor stuff 2025-01-27 16:37:04 +01:00
Dirk Wetter 8e39d161a8 cleaner code 2025-01-27 16:36:42 +01:00
Dirk Wetter 0640eb9004 Several CI fixes 
- don't output stdin on terminal
- adapt to different google.com ip addresses
- cleaner code
 2025-01-27 16:33:58 +01:00
Dirk WetterandGitHub 04c98d93ab Merge pull request #2628 from testssl/diffing_openssls 
Add unittest for different openssl versions
 2025-01-24 21:38:26 +01:00
Dirk ce8984706e Finalize unit test 
* pattern search + replace for tls_sockets() vs. openssl
* better error handling for invocations with perl functions system + die
 2025-01-24 20:36:59 +01:00
Dirk cbaa813a40 Merge branch '3.2' into diffing_openssls 2025-01-24 19:47:40 +01:00
Dirk WetterandGitHub d115b2ebbf Merge pull request #2635 from testssl/fix_2633 
Fix bug when legacy NPN is tested against a TLS 1.3 host
 2025-01-24 19:44:49 +01:00
Dirk d9b293f6c7 fix typo 2025-01-24 18:51:11 +01:00
Dirk 43a0099fbc Fix bug when legacy NPN is tested against a TLS 1.3 host 
When testing a TLS 1.3 host s_client_options used TLS 1.3 ciphers to test
for NPN. As that is not implemented we nee dto make sure any other version
is used.

This PR ensures that --after testing whether it's a TLS 1.3-only host
where this test doesn't make any sense in the first place.

Fix for #2633
 2025-01-24 18:46:07 +01:00
Dirk WetterandGitHub 5c1232b9dc Merge pull request #2566 from testssl/bump_version 
Bump version to 3.2rc4
 2025-01-24 15:47:11 +01:00
Dirk 76cdf3166a fix typo 2025-01-24 14:53:52 +01:00
Dirk bf75a91bc7 Merge branch '3.2' into bump_version 2025-01-24 14:41:21 +01:00
Dirk WetterandGitHub 5eeab6484f Merge pull request #2632 from testssl/Tazmaniac-client-renego-refactoring 
Tazmaniac client renego refactoring
 2025-01-24 14:24:43 +01:00
Dirk 002b91192c fix spelling 2025-01-24 13:50:35 +01:00
Dirk 49db77e63a Conflicts resolved 2025-01-24 13:44:19 +01:00
Dirk Wetter 163d744c13 Add recent and bigger changes 
From today back to 1f37a8406f
 2025-01-24 11:32:41 +01:00
Dirk Wetter 0042b6313e s/drwetter/testssl 
For the remaining occurences. Except dockerhub which needs to be solved.
 2025-01-24 11:15:55 +01:00
Dirk Wetter 69d6a50696 Merge branch '3.2' into bump_version 2025-01-24 11:05:00 +01:00
Dirk WetterandGitHub 0539688c06 Merge pull request #2631 from testssl/corydalis10-3.2 
Improve CONTRIBUTING.md
 2025-01-23 17:42:29 +01:00
Dirk b185b1bea9 Fix typo 2025-01-23 17:41:36 +01:00
Dirk 90f1e59e9f Merge #2618 and doing some overdue amendments 2025-01-23 17:37:32 +01:00
Dirk 8f054c6f12 Merge branch '3.2' of https://github.com/corydalis10/testssl.sh into corydalis10-3.2 2025-01-23 16:49:12 +01:00
Dirk WetterandGitHub 9e9334f3c8 Merge pull request #2619 from testssl/co_header 
Add more security headers
 2025-01-23 11:47:34 +01:00
Dirk Wetter 4efe324ef7 Fix round bracket and remove obsolete comment 2025-01-23 10:45:15 +01:00
Dirk WetterandGitHub 7d919d494c Merge pull request #2629 from testssl/misc 
Remove --nsa in help() and add --forward-secrecy instead
 2025-01-22 23:37:28 +01:00
Dirk d7da22d598 Finalize check 
* use system with @args so that we can query the return value
* code style improved for readability
* diff shows the filtered difference
* ok instead of cmp_ok to show not the whole content of vars
 2025-01-22 23:33:35 +01:00
Dirk 4df0d9e4c3 Re-added the ) to make the action word (why??) 2025-01-22 23:32:39 +01:00
Dirk 207b902109 Merge branch '3.2' into co_header 2025-01-22 22:50:00 +01:00
Dirk ad912ea332 Fix typo + tags 2025-01-22 20:05:19 +01:00
Dirk 12036fb6c8 Update baseline scan + add/deprecate security headers 2025-01-22 19:54:34 +01:00
Dirk a1c2dc7c72 Remove --nsa in help() and add --forward-secrecy instead 
Both are possible to use
 2025-01-22 19:19:16 +01:00
Dirk ba58458909 Restrict tests to those which use openssl 2025-01-22 18:37:48 +01:00
Dirk 37d987684e remove comment sign from testing 2025-01-22 18:25:54 +01:00
Dirk a499233df2 Add unittest for diffrent openssl versions 
This adds a unit test to compare a run against google with the supplied openssl
version vs /usr/bin/openssl .

This would fix #2626.

It looks like there are still points to clarify
* NPN output is different (bug)
* Newer openssl version claims it's ECDH 253 instead of ECDH 256.
* Newer openssl version claims for 130x cipher it's ECDH 253, via sockets it´s ECDH/MLKEM. This seems a bug (@dcooper)

A todo is also restricing the unit test to the one where openssl is being used. E.g. the ROBOT check and more aren't done with openssl. So there's no value checking this here.
 2025-01-22 18:12:53 +01:00
Dirk WetterandGitHub 17f2a5d5b9 Merge pull request #2622 from dcooper16/draft-kwiatkowski-tls-ecdhe-mlkem 
Support draft-kwiatkowski-tls-ecdhe-mlkem
 2025-01-22 11:03:11 +01:00
Dirk WetterandGitHub 023fd0278a Merge pull request #2625 from dcooper16/fix_x5519_and_x448_check 
Fix checks for whether X25519 and X448 are supported
 2025-01-22 11:01:25 +01:00
Dirk WetterandGitHub 0c71658457 Merge pull request #2621 from dcooper16/fix2614 
Fix #2614
 2025-01-17 16:47:27 +01:00
Dirk Wetter 8000885371 Add more security headers 
... and deprecate "X-Content-Security-Policy" and "X-WebKit-CSP"
 2025-01-16 21:18:47 +01:00
Dirk WetterandGitHub daf0671878 Merge pull request #2617 from dcooper16/fix2615 
Fix #2615
 2025-01-16 16:51:47 +01:00
Dirk WetterandGitHub ef92cc70c9 Merge pull request #2616 from testssl/dependabot/github_actions/docker/build-push-action-6.12.0 
Bump docker/build-push-action from 6.11.0 to 6.12.0
 2025-01-16 12:20:07 +01:00
Dirk WetterandGitHub 90a51e7975 Merge pull request #2612 from testssl/dependabot/github_actions/docker/setup-qemu-action-3.3.0 
Bump docker/setup-qemu-action from 3.2.0 to 3.3.0
 2025-01-09 09:53:54 +01:00
Dirk WetterandGitHub 723b1c17ee Merge pull request #2613 from testssl/dependabot/github_actions/docker/build-push-action-6.11.0 
Bump docker/build-push-action from 6.10.0 to 6.11.0
 2025-01-09 09:52:52 +01:00
Dirk WetterandGitHub 6d77c93109 Merge pull request #2610 from testssl/links 
Change orga from drwetter --> testssl
 2025-01-06 16:20:53 +01:00
Dirk WetterandGitHub 5f4ca15e57 Merge branch '3.2' into links 2025-01-06 15:41:16 +01:00
Dirk b708026151 Change orga from drwetter --> testssl 
... to avoid redirects on the client side and to make repo migration better visible.

Also amend 'Status' and 'Contributing' in Readme.md. bluesky added, albeit mastodon
seems more interactive. Clarify twitter account is not in use anymore.
 2025-01-06 15:34:45 +01:00
Dirk WetterandGitHub b5ad5bd859 Merge pull request #2604 from drwetter/dependabot/github_actions/docker/build-push-action-6.10.0 
Bump docker/build-push-action from 6.9.0 to 6.10.0
 2024-12-06 15:03:47 +01:00
Dirk WetterandGitHub 701c606eac Merge pull request #2597 from Tazmaniac/quick-fix-2590 
Quick fix for #2590
 2024-11-27 11:39:25 +01:00
Dirk WetterandGitHub 662a99fdce Merge pull request #2602 from dcooper16/fix2599 
Fix #2599
 2024-11-27 11:35:41 +01:00
Dirk WetterandGitHub 65c463fcbf Merge pull request #2600 from janbrasna/fix/ci-badge 
Fix CI badge
 2024-11-19 20:49:27 +01:00
Dirk WetterandGitHub 245ad2ae4a Merge pull request #2592 from dcooper16/integrity_only_ciphersuites 
Support RFC 9150 cipher suites
 2024-10-29 00:35:34 +01:00
Dirk WetterandGitHub 192505d700 Merge pull request #2591 from dcooper16/libressl4 
Support LibreSSL 4.0.0
 2024-10-29 00:30:38 +01:00
Dirk WetterandGitHub 6452ec997e Merge pull request #2589 from dcooper16/sha256_stapled_ocsp 
Accept stapled OCSP responses that use SHA-256 in CertID
 2024-10-17 09:46:10 +02:00
Dirk WetterandGitHub b2e6f990b9 Merge pull request #2588 from drwetter/fix_2582 
Mute socat killing & improve STARTTLS grading explanation
 2024-10-15 12:26:35 +02:00
Dirk 0abca6f067 Mute socat killing & improve STARTTLS grading explanation 
Fixes #2582 .
 2024-10-15 10:56:29 +02:00
Dirk WetterandGitHub ba51ca7879 Merge pull request #2587 from drwetter/fix_hexdump_docker 
Add link for hexdump correctly
 2024-10-15 09:57:08 +02:00
Dirk fc309b7ee0 Add link for hexdump correctly 
... in Dockerfile, see #2586
 2024-10-15 09:54:35 +02:00
Dirk WetterandGitHub 5064d3073c Merge pull request #2584 from drwetter/upgradeDockerfile_Lep15.6 
Upgrade Dockerfile to leap 15.6
 2024-10-14 18:13:35 +02:00
Dirk WetterandGitHub b7a4d5c692 Merge pull request #2583 from drwetter/minor_polish_unitTests 
Minor polish unit tests
 2024-10-14 18:08:35 +02:00
Dirk 0f44d6777a Upgrade Dockerfile to leap 15.6 
As EOL comes closer for openSUSE Leap 15.5 (https://en.opensuse.org/Lifetime)
an update is needed.

``busybox-util-linux`` and ``busybox-vi`` had to be removed as they don't exist
anymore. Busybox was added but hexdump was not provided by the vendor.
As busybox was compiled "properly" hexdump can be added by just linking to it.

This fixes #2563
 2024-10-14 17:51:24 +02:00
Dirk WetterandGitHub 656726eaab Merge pull request #2580 from drwetter/fix_2575 
Fix json/csv output when STARTTLS problem is passed back
 2024-10-14 17:16:09 +02:00
Dirk e0e742379c see previous commit 2024-10-14 17:15:43 +02:00
Dirk ae77349f3a see previous commit 2024-10-14 17:11:55 +02:00
Dirk 9b48c1641b Minor polish unit tests 
This PR (re-)names the unit test starter properly and improves for some unit tests the phrasing and formatting.
 2024-10-14 17:08:12 +02:00
Dirk 33fd749af8 Fix json/csv output when STARTTLS problem is passed back 
In rare cases testssl.sh writes in the terminal output "likely not offered" but
misses the "likely" in the json/csv output.

This fixes #2575 by adding that word and amending the return value 4 with
a comment.
 2024-10-14 16:15:18 +02:00
Dirk WetterandGitHub fee04f2db8 Merge pull request #2579 from drwetter/merge_2568 
Merge 2568
 2024-10-14 15:55:40 +02:00
Dirk fa5664f434 Polish comment + grade cap reason for STARTTLS 2024-10-14 14:17:02 +02:00
Dirk 7c0ccb3da7 Fix HTML output in #2568 2024-10-14 13:08:45 +02:00
Dirk 6c771f7902 Merge branch '3.1dev' of https://github.com/magnuslarsen/testssl.sh into magnuslarsen-3.1dev 2024-10-14 13:03:46 +02:00
Dirk WetterandGitHub ddb84c27ce Merge pull request #2577 from drwetter/fix_f5_short_rfc1918 
Fix F5 cookie in 10.x.x.x.
 2024-10-12 19:30:19 +02:00
Dirk Wetter 6110843fd0 The F5 cookie decoder doesn't detect IPs in the 10.x.x.x space for non-encrypted cookies. 
This fixes the regex pattern, see also

https://github.com/drwetter/F5-BIGIP-Decoder/pull/4/files
 2024-10-09 15:47:50 +02:00
Dirk WetterandGitHub 541d3ff07a Merge pull request #2574 from drwetter/dependabot/github_actions/docker/build-push-action-6.9.0 
Bump docker/build-push-action from 6.8.0 to 6.9.0
 2024-10-01 10:15:12 +02:00
Dirk WetterandGitHub 93e5d3bcd1 Merge pull request #2573 from drwetter/dependabot/github_actions/docker/build-push-action-6.8.0 
Bump docker/build-push-action from 6.7.0 to 6.8.0
 2024-09-30 09:27:54 +02:00
Dirk WetterandGitHub 94bbfff50c Merge pull request #2569 from DaanSelen/patch-1 
Minor English change
 2024-09-20 10:38:10 +02:00
Dirk b5427e3006 Bump version to 3.2rc4 2024-09-08 16:32:19 +02:00
Dirk WetterandGitHub 92bc6d4873 Merge pull request #2565 from drwetter/automagic 
Amend docs wrt STARTTLS, clarify automagic switch for TLS 1.3 only hosts
 2024-09-08 14:49:58 +02:00
Dirk Wetter 04c5ee391d "only" was important here 2024-09-08 13:19:16 +02:00
Dirk Wetter 4ce91d7d61 Explain OSSL_SHORTCUT better, "automagically" is the word we wanted to use 2024-09-08 12:27:51 +02:00
Dirk Wetter c5b07e7d99 Make the client side security clearer for STARTTLS 
... also in the man pages. See also #2564.
 2024-09-08 12:22:52 +02:00
Dirk WetterandGitHub be3e7651bb Merge pull request #2564 from drwetter/starttls_phrasing 
Phrasing of reason for STARTTLS grading improved
 2024-09-07 17:08:50 +02:00
Dirk 3b85f53d52 added an accidently erased char 2024-09-07 16:15:03 +02:00
Dirk a1c67c0794 proper English 2024-09-07 16:03:53 +02:00
Dirk f9edaa7fe1 Phrasing of STARTTLS grading improved 
... a a comment added in the desciption.

Unfortunately I couldn't get the line wrapping working.
 2024-09-07 15:51:12 +02:00
Dirk WetterandGitHub 30f80cf9b3 Merge pull request #2561 from drwetter/fix_1312 
Fix 1312
 2024-09-06 18:55:24 +02:00
Dirk WetterandGitHub 9efe597a86 Merge pull request #2562 from drwetter/revert-2547-drwetter-patch-1 
Revert "Update Dockerfile to leap 15.6"
 2024-09-06 18:00:14 +02:00
Dirk WetterandGitHub bb7d9f4ac5 Revert "Update Dockerfile to leap 15.6" 2024-09-06 17:53:58 +02:00
Dirk 733c2d31b7 Automagic with openssl and TLS 1.3-only host 2024-09-06 17:37:42 +02:00
Dirk 52213d3072 Suppy documenation for TLS 1.3 only hosts 
and the automagic wrt /usr/bin/openssl OPENSSL2 and OSSL_SHORTCUT
 2024-09-06 17:32:53 +02:00
Dirk 3d2bd5020c fix spellcheck 2024-09-06 13:00:27 +02:00
Dirk 12bc15adc3 misc 
- remove 1xLF in UI
- fix obsolete statment for OPENSSL2
 2024-09-06 12:53:00 +02:00
Dirk becd310390 Address open UI problems for TLS 1.3 only hosts 
While in 3.2 there was only a hint how to deal with TLS 1.3 only hosts, a restart
with --openssl=/usr/bin/openssl or setting of OSSL_SHORTCUT-true was required.

This PR changes the behavior: if an openssl version can be found in /usr/bin/openssl
(or SUPPLIED via OPENSSL2=/home/version/ofopenssl testssl <cmdline>) which
supports TLS 1.3 it switches automatically and informs the user that it has done so.
   This message is asynchonous and is implemented with a new function check_msg()
and a global OPEN_MSG, so that we maintain the formatting. Otherwise it would have
appeared between rDNS and service detection. Now it's nicely after service detection.
 2024-09-06 12:47:03 +02:00
Dirk WetterandGitHub a20fd796e8 Merge pull request #2552 from drwetter/fix_2466 
Trailing space after value in header is fine
 2024-09-03 20:51:18 +02:00
Dirk WetterandGitHub 031c2a55ec Merge pull request #2553 from drwetter/noCtrlCharInHeader 
Remove crtl chars from HTTP header
 2024-09-03 20:50:18 +02:00
Dirk WetterandGitHub 3cd027e1f1 Merge pull request #2551 from drwetter/banner 
Improve banner (3.2)
 2024-09-03 19:27:46 +02:00
Dirk 2b36b33112 Remove crtl chars from HTTP header 
... which fixes #2337
 2024-09-03 19:24:46 +02:00
Dirk 30a33e9a6e Trailing space after value in header is fine 
This fixes #2466.
 2024-09-03 19:10:29 +02:00
Dirk dbb8fc8013 Fix CI 2024-09-03 18:28:56 +02:00
Dirk 408e8f84f4 modify issue template for bash version 2024-09-03 15:42:54 +02:00
Dirk 5a1fd2623f Improve banner (3.2) 
... for readability and bugs to be filed (fixes #2506)

This PR defines a short string for the OpenSSL banner as some suppliers have made them (unnecessarily) long so that it won't fit nice in the banner anymore.

The banner also now omits the built line from openssl as for the user it is normally not important.
 2024-09-03 15:40:55 +02:00